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ABSTRACT 

The International Space Station (ISS) United States 
Orbital Segment (USOS) Oxygen Generation System 
(OGS) was originally intended to be installed in ISS 
Node 3. The OGS rack delivery was accelerated, and it 
was launched to ISS in July of 2006 and installed in the 
US Laboratory Module. Various modification kits were 
installed to provide its interfaces, and the OGS was first 
activated in July of 2007 for 15 hours. In October of 
2007 it was again activated for 76 hours with varied 
production rates and day/night cycling. Operational time 
in each instance was limited by the quantity of feedwater 
in a Payload Water Reservoir (PWR) bag. Feedwater 
will be provided by PWR bag until the USOS Water 
Recovery System (WRS) is delivered to ISS in fall of 
2008. This paper will discuss operating experience and 
characteristics of the OGS, as well as operational issues 
and their resolution. 


INTRODUCTION 

The U.S. regenerative Environmental Control and Life 
Support Systems (ECLSS) have been developed to 
enable the ISS to expand its crew size from three to six 
crewmembers. These regenerative systems include the 
Water Recovery System (WRS) and the OGS. The 
OGS includes the Oxygen Generation Assembly (OGA), 
the Power Supply Module (PSM) that supports the OGA, 
and scars to accommodate the later addition of a 
Sabatier Carbon Dioxide Reduction Assembly (CRA). 
Earlier development activities are summarized in 
references 1-7. 


OXYGEN GENERATION SYSTEM 

OGA OVERVIEW - A simplified schematic of the OGA is 
shown in Figure 1 and its installation in the OGS rack is 
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shown in Figure 2. Feed water from the potable water 
bus enters the assembly through the Water Orbital 
Replacement Unit (ORU) and flows through an Inlet 
Deionizing Bed, which serves as an iodine remover as 
well as a coalescer for any gas bubbles that may be 
present in the feed water, if gas bubbles are detected 
by the gas sensor downstream of the Dl bed, the feed 
water is rejected to the waste water bus. This serves to 
prevent any oxygen that may be present in the feed 
water from mixing with generated hydrogen. Water is 
electrolyzed into oxygen and hydrogen in the Hydrogen 
ORU, which contains the electrolysis cell stack. Oxygen 
produced by the cell stack passes through the Oxygen 
Outlet ORU containing a water absorber, which protects 
the downstream hydrogen sensors from liquid moisture. 
The Hydrogen Sensor ORU monitors the product oxygen 
for the presence of hydrogen, which would indicate a 
problem with the cell stack and signal the controller to 
shut down the OGA. The Rotary Separator Accumulator 
(RSA) within the H 2 ORU separates the product gaseous 
hydrogen from the water which is re-circulated by the 
Pump ORU. The Nitrogen Purge ORU serves to purge 
system lines upon shutdown with nitrogen, and the 
Process Controller ORU is responsible for OGA System 
command/control and communication with the ISS 
Multiplexer/Demultiplexer (MDM). 




Figure 1. OGA Simplified Schematic 



Figure 2. Oxygen Generation System 

The OGA is designed to generate oxygen at a maximum 
nominal rate of 5.4 kg/day (12 Ib/day) when operated on 
day/night orbital cycles, and also at a selectable rate 
between 2.3 and 9.2 kg/day (5.1 and 20.4 Ib/day) when 
operated continuously. At the nominal rate, the OGA 
can support oxygen needs for 4 crew, biological 
specimens, and atmosphere leakage, while at the 
maximum rate it can support 7 crew, biological 
specimens, and atmosphere leakage. The assembly 
consumes 3573 W when processing, and 382 W during 
standby. The product oxygen meets quality 
specifications for temperature, free water, dewpoint, and 
hydrogen content. 


POWER SUPPLY MODULE OVERVIEW - The PSM is 
shown in the lower left of the OGS rack in Figure 2. The 
PSM provides 10-55 amps current to the OGA cell stack 
during Process mode and 1.0+/-0.2 amps during 
Standby mode, with a minimum efficiency of 91% in 
Process mode. The PSM is designed for 60,000 
process/standby cycles, and a 10-year life. 

ON-ORBIT OPERATION 

The OGS has been activated three times since its 
installation in the ISS. In the first activation, the OGS 
operated in Standby (~2% of maximum oxygen 
production) for 6.8 hours and in Process (25% to 100% 
of maximum oxygen production) for 15.8 hours, which 
converts to approximately 13.4 Equivalent Full Power 
Hours (EFPH). During the second activation, the OGS 
operated in Standby for 26.5 hours and in Process for 
47.1 hours, which convert to approximately 31 EFPH. 
The third activation production parameters have not yet 
been quantified, but the OGS operated between 25% 
and 100% production rates, in both cyclic and 
continuous modes, for approximately 112 hours. The 
following sections describe the activations in more detail. 

FIRST ACTIVATION, ON-ORBIT DAY 2007:192 (JULY 
11)- When the first activation of the Oxygen Generation 
System (OGS) was attempted on July 11, 2007, it was 
understood that there could be some problems with 
startup. The system had been dormant — apart from 
powering the controller, the recirculation pump, and 
some valves — since December 2005. It was known that 
the water in the hydrogen side of the cell stack would 
permeate to the oxygen side, and the nitrogen in the 
oxygen side would permeate to the hydrogen side. As a 
result, the RSA would be low in water and would likely 
cause a shutdown. Also, since water permeates to the 
oxygen side of the stack, this water would then be 
pushed into the hydrogen dome during the initial 
nitrogen purge of the cell stack, which would extend the 
needed time to dry out the dome. 

In light of this information, it is not surprising that there 
were 11 fast shutdowns caused by system conditions 
during the attempted startup of the OGS. Fault limit 
overrides were implemented to overcome many of the 
difficulties of starting the system. The timeline for the 
first activation is shown in Figure 3. 

Before the OGS can start, the hydrogen dome must be 
evacuated and dried of any water. The dome must be 
dry to allow for leakage detection, and enough time must 
be given to evacuate the dome to vacuum to evaporate 
any resident water so that the dome pressure will not 
rise above the pressure trip-point after the evacuation 
procedure is complete. Not enough time was allowed for 
this evacuation procedure in the software, so high 
hydrogen dome pressure caused the first two fast 
shutdowns. As mentioned above, these shutdowns 
were caused by the fact that the system was dormant for 
so long that water accumulated in the oxygen side of the 
cell stack, which was then purged into the hydrogen 




dome. The first startup attempts dried the dome enough 
so that, by the third attempt, the dome had dried enough 
so another high dome pressure failure was avoided. 




Figure 3: 1 st Activation Timeline 


A low RSA volume caused the third fast shutdown. This 
was expected to be a problem due to water crossover in 
the cell stack, so overrides were prepared for the RSA 
trip point and speed so that the system could continue 
with the startup procedure and eventually fill the RSA 
with water. 

High water flow rate in the OGS water recirculation loop 
appeared to be the cause of the fourth and fifth 
shutdowns. However, it is speculated that it was not, in 
fact a high flow rate that caused the shutdown, but an 
anomaly with the Venturi used to measure the flow rate. 
Since the RSA speed was increased after the third 
shutdown to remedy the low RSA water condition, it was 
speculated that the extra speed in the RSA caused an 
increase in water flow. However, a similar condition was 
observed in ground testing, and was attributed to gas 
bubbles in the Venturi pressure taps causing errors in 
the readings. The solution implemented in the ground 
tests was to push high flows of water through the Venturi 
to purge the bubbles. This solution worked, and so the 
bubble theory was accepted. In order to continue 


beyond this failure, the shutdown trip-point was 
overridden to a higher flow rate. Higher recirculation 
flow rates were used during on-ground system testing, 
and there is no safety limit restricting the upper limit of 
the recirculation flow, so this override was not 
considered a problem. Later in the startup procedure, it 
was found that this initial high reading from the Venturi 
decreased back to expected levels. 

After the fifth shutdown, Standby mode was achieved 
with RSA quantity nominal at over 328 ml. After 
commanded Shutdown, the overrides for the RSA were 
removed. The community may have thought that a 
water fill had been initiated during the startup, making 
these overrides unnecessary. However, the next startup 
attempt, number six, showed that the RSA was still too 
low and caused the sixth shutdown as a result. The low 
RSA quantity overrides were reinstated for the next 
startup attempt. 

Even though the RSA water level software limits had 
been overridden low for the seventh startup, hardware 
shutdown limits exist that measured the water level 
readings and prevented the recirculation pump from 
starting. Software fault limits exist for the delta pressure 
over the pump, arid the pump speed, which tripped the 
seventh shutdown. Previous startups had avoided this 
fault by increasing the RSA speed, which increased the 
delta pressure reading in the RSA. The higher pressure 
met the hardware limit requirements. Once the RSA 
speed was no longer overridden high, the delta pressure 
reading in the RSA was no longer high enough for the 
hardware shutdown limits. The higher RSA speed 
override was implemented for the next startup attempt. 

The eighth startup attempt was not only able to reach 
Standby operation, where a small amount of power is 
supplied to the cell stack, but was also able to reach an 
oxygen production rate of 25%. However, when an 
attempt was made to remove the RSA speed override 
while the system was running, the system shut down 
due to the change in system operation caused by the 
removed override. For the next activation attempt, the 
speed override was not added to the override list. 

Since operation of the cell stack was reached in the 
eighth startup, more water was consumed by the 
system, and hydrogen gas was now in the hydrogen side 
of the cell stack. Also, the system did not initiate a water 
fill, because at low production rates, less water is 
required by software to be in the RSA. As a result, at 
the ninth startup, the low RSA level was lowered even 
more when the recirculation pump started and pushed 
hydrogen gas from the cell stack into the RSA. This 
caused another fast shutdown, requiring the previously 
removed RSA overrides — the speed and quantity 
overrides — to be reinstated for the next startup attempt. 

After the tenth startup, the system finally initiated a water 
fill. However, there was still a speed override on the 
RSA, which forced the RSA to run at a specific rotational 
speed. Because there was a water fill, there was more 



torque required to maintain that speed. Unfortunately, 
the RSA motor current reached a hardware limit and 
prevented the RSA from reaching the required speed, 
which was noticed by software (a tolerance fault) and 
caused the tenth shutdown. An attempt was made to 
start the system again without change, but the same 
shutdown occurred. 

Activation was finally successful with a complex set of 
overrides and a process to gradually remove these 
overrides after activation was achieved. After the 11 
shutdowns, the system ran well and was able to run at 
25%, 50%, 75%, and 100% production. Once the 
system reached 100%, it was run at that level for several 
hours until the water supply was exhausted. 


SECOND ACTIVATION, ON-ORBIT DAY 2007:275 
(OCTOBER 4) - Much was learned during the first 
activation of the OGS which was applied to the second 
activation. The activation procedure was modified to 
include several fault limit overrides that were 
implemented during the first activation. A longer period 
of time was allowed to evacuate the dome so that any 
water in the dome would have plenty of time to 
evaporate. The maximum recirculation loop flow rate trip 
point was increased. The low RSA water level limits 
were decreased and the RSA speed command was kept 
within its capability. As a result, the system was brought 
up to power on the first startup attempt and was able to 
complete a full day of 50% day/night cycling. The 
timeline for the second activation is shown in Figure 4. 
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Figure 4: 2 nd Activation Timeline 


To simulate a loss of power, Stop was commanded to 
immediately remove power from all effectors while at 
50% production rate. When a restart was attempted, an 
RSA high level shutdown was tripped when the system 
was commanded to Standby operation. This occurred 
because when the system powers the cell stack, 
hydrogen production pushes a fair amount of water into 
the RSA. In previous startups, this failure was close to 
being tripped, but never caused a shutdown. A second 
attempt to start the system was made with no changes, 
but the same failure occurred. Therefore, the maximum 
RSA water level limit was temporarily increased in the 
software to accommodate this condition. 

The system was started again with no problems, and 
proceeded to 25% production for about 2 hours. Next 
the system was set at day/night cycling at 100% 
production for about 10 hours to demonstrate it’s 
functionality at that power level. It was then switched to 
100% continuous production for another 8 hours. 

Next, the system was commanded to standby since a 
long Loss Of Signal (LOS) period was imminent, and it 
was known that the system had nearly exhausted its 
external water supply. It is desirable to shut the system 
down manually before the external water supply is 
completely exhausted to prevent the RSA water level 
from being low for the next startup. After about 2 hours 
of standby operation, the LOS passed and the system 
was powered to 100% continuous production with no 
problems. This power level was maintained until the 
system consumed all of its available water. 

THIRD ACTIVATION, ON-ORBIT DAY 2008:058 
(FEBRUARY 27) - At this time there was a 
comprehensive set of overrides in a procedure, 
including two additional RSA high-quantity overrides 
identified in Activation #2. We had, however, reduced 
the RSA override commanded speed due to its inability 
to reach the speed commanded. Added to this was the 
potential increased loss of RSA quantity due to cell stack 
diffusion into the evacuated dome for 144 days since 
Activation #2. See the timeline for faults in Figure 5: 



Figure 5: 3 rd Activation Timeline 


After fault #1 and #2, before which the RSA interlock 
with the pump did not set, the RSA speed was increased 
to the level which had previously provided a successful 
startup. This allowed the startup to progress further, but 
also resulted in fault #3 as the RSA differential pressure 
slowly decreased. A successful startup was enabled by 
a complex set of overrides with the goal of providing cell 
stack current and an RSA fill as soon in the startup 
process as possible. This was done by disabling as 
many built-in tests as possible and commanding Process 
at 25% rate instead of Standby. After an RSA fill, 
Shutdown was commanded to re-enable built-in tests. 
Standby was commanded with the procedural overrides 
as officially documented. 

GENERAL DISCUSSION OF STARTUP FAILURES 

The faults encountered during startup attempts are of 
five classifications. 

1. High dome pressure 

2. Pump speed-The recirculation pump is not 
running when it should. 

3. High recirculation flow differential pressure- 
Bubbles in the recirculation loop are blocking the 
flow sensor. 

4. High or low RSA quantities 

5. Tolerance faults 

HIGH HYDROGEN ORU DOME PRESSURE - The first 
two faults in Activation #1 were because the dome 
pressure did not reduce to below shutdown limits after a 
startup nitrogen purge. This was considered to be 
because of liquid that still existed in the dome. The 
problem did not occur after, but a permanent override 
extending the dome venting after a startup purge was 
implemented, since there was determined to be no 
impact to Safety. 


RSA DIFFERENTIAL PRESSURE INTERLOCK WITH 
THE RECIRCULATION PUMP - If the differential 
pressure across the RSA at sensor 7331-3 cannot 
exceed 64.65 mmHg (reset limit) or drops below 56.89 
mmHg, a hardware interlock prevents the recirculation 
pump from being powered. This is to prevent gas from 
entering the recirculation loop and being a source of 
combustion. Figure 6 shows a startup sequence from 
Activation 1, which did not reset the interlock (pump 
never turned). The initial part of the chart shows RSA 
operation at a lower speed to evolve dissolved gas. 
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Figure 6: RSA Differential Pressure Sensors, 2007 Day 
193, GMT 4:17 



Figure 7: RSA Differential Pressure Sensors, 2008 Day 
059, GMT 2:58 


It’s evident that the pressure reading of the two RSA 
differential pressure sensors 7331-1 (software only, and 
the quantity control sensor) and 7331-3 (hardware 
interlock) are not consistent. On occasion as shown in 
Figure 7, 7331-3 is as much as 5 mmHg below 7331-1. 
The pump interlock function of 7331-3 cannot be 
inhibited or modified. The 7331-3 interlock does not 
result in a software fault by itself, but related software 
faults will result if the pump does not come up to speed 
within 15 (default) seconds. The first three activations 
have been achieved by overriding the RSA speed from 
default of 1500 RPM to 1783 RPM. This increases the 




differential pressure by centrifugal force toward the 
outside of the RSA. The value is reduced after 
successful activation to reduce wear on the RSA. 

For activation #3, it was also necessary to accelerate 
cell current and RSA fill by inhibiting built-in tests. 
Figure 7 illustrates how this assists in successful 
activation before the 7331-3 interlock can be tripped. 

HIGH RECIRCULATION FLOW DIFFERENTIAL 
PRESSURE FAULT - Activation #1 Faults 4 and 5 were 
due to high differential pressure across the flow sensor 
venturi FL_7531_1. Previous to these faults, the RSA 
quantity reading had dipped to 98 ml. Since this value is 
filtered, the actual value may have been lower. This is 
evidence that gas actually did enter the recirculation loop 
during our attempt to restart with low RSA quantity. The 
gas cleared itself after a subsequent attempt (fault 5). 

HIGH OR LOW RSA QUANTITIES - There are 
problems with the reference values of the RSA leakage 
detection. These faults protect against leakage into the 
recirculation loop from process coolant, or leakage out of 
the recirculation loop into the rack. The minimum 
reference value for the low level fault is 327.74 ml. If the 
measured RSA quantity is more than 98.3 ml below this 
value, a low quantity fault will occur. Another reference 
value for the high fault is set at the lowest actual RSA 
quantity, and the fault will occur if the quantity increases 
by 163.9 ml when the system is not in a fill mode. If the 
lowest value is 200 ml, the fault will occur at 363.9 ml. 
The limits must be expanded for successful activation, 
and then reset to perform their safety function during 
OGS operation. 

TOLERANCE FAULTS - During Activation #1, the RSA 
speed was overridden to a faster speed than it was able 
to support. This resulted in a tolerance fault between the 
RSA commanded and actual speed. The default limit is 
54 RPM. Another tolerance fault was encountered when 
the speed was reduced and the software did not 
anticipate a delay to reach the commanded speed. The 
tolerance is increased to 200 RPM, and returned to 
default after successful activation. 

FAULT SUMMARY - The RSA 7331-3 interlock can be 
“fooled” into allowing startup by increasing the RSA 
rotational speed. This is at the risk of allowing gas into 
the recirculation loop if the level is too low. The 
remaining software faults can be avoided by up to about 
15 overrides which must be removed after successful 
activation. 

Some of the overrides identified as necessary for 
successful activation were made “permanent”. These 
had no impact on operation or safety function, and 
included recirculation loop flowrate high limit and 
transient time for the dome to be evacuated after a 
startup nitrogen purge of the cell stack. 

Other overrides reduced the hazard controls for leakage 
detection temporarily until successful activation. The 


controls were then re-enabled by resetting the overrides 
after a successful startup was achieved. 

PLANS FOR FUTURE SUCCESSFUL ACTIVATIONS 

Only one potential issue with the OGS operation while in 
Process or Standby has been identified. During an 
extended period in Standby, the heated hydrogen outlet 
tubing increases in temperature due to reduced product 
hydrogen cooling flow. The temperature sensor is 
downstream of the hydrogen outlet heater, and they are 
both between the RSA and a regulator which maintains 
pressure against space vacuum. As soon as hydrogen 
flow commences the temperature spikes. The highest 
temperature seen was 4.3C below the default shutdown 
limit, which is based on the derated material limits. This 
value will be monitored, but currently no changes are 
planned. 

After the end of each OGS Activation, the RSA quantity 
has been maximized on commanded Shutdown. Since 
the WDS pressure drops as its accumulator quantity 
decreases, the RSA fill quantity also decreases. At 
some point, the RSA quantity increase will be insufficient 
for a successful fill. At this point, software will attempt a 
second fill in 30 seconds. Therefore, Shutdown is 
commanded after a confirmed RSA double fill. 

Since the OGS dome is evacuated during extended 
shutdowns, measurable diffusion occurs from the OGS 
cell stack to space. The time between activations 2 and 
3 was 144 days. Activations will be scheduled within 
approximately 90 days of the previous to minimize water 
loss. 

The overrides for successful activation will be as 
baselined in the Activation #3 procedure, with the RSA 
rotational speed increased to 1783 RPM. This speed 
contributed to success in Activations 1 and 3, and the 
procedure, including all overrides, was successfully used 

In the future, the RSA quantity may not be maximized 
when preparing for extended storage. This may be due 
to OGS failures, interface failures, or resource issues. It 
may therefore be necessary to fill the RSA from 
feedwater sources at the next operation opportunity 
using overrides. An overfill may occur during this 
process. There are safety and operational concerns with 
this process that still need to be addressed. The reason 
that the OGS software does not allow an RSA fill until 
activation is complete is so that the gaseous composition 
within the > RSA can be first confirmed to be pure 
hydrogen by hydrogen production and venting. RSA fill 
quantity is limited by design and software so that 
dissolved oxygen in the feedwater cannot create a 
combustible mixture within the RSA when evolved. 
Investigation into a method of recovering proper RSA 
quantity will continue. 

HYDROGEN SENSOR ORU PURGE ADAPTER 
(HOPA) 



When in operation, the OGS produces oxygen with a 
high relative humidity. Heaters in the outlet stream and 
in the Hydrogen Sensor ORU prevent condensation from 
forming. When the OGS is powered down, the heaters 
are shut off, >gas flow is restricted, and there is a high 
potential for condensation to form on the cooling sensor 
dies inside the Hydrogen Sensor ORU. Sensor dies 
could be damaged if power is applied when water has 
collected on the dies. The Hydrogen Sensor ORU Purge 
Adaptor (HOPA) was designed and manufactured to 
purge moist oxygen from the Hydrogen Sensor ORU 
after OGS power-down. This purge prevents 
condensation from forming on the sensor dies and 
preserves sensor calibration life. The HOPA is made up 
of three tools: Evacuation, Inlet and Outlet Tools. 
Reference Figures 8-10. 



Figure 8: Evacuation Tool 



Figure 10: Outlet Tool 


HOPA PROCEDURE - The process to purge the 
Hydrogen Sensor ORU is quite simple. After OGS 
shutdown, the crew disconnects inlet and outlet quick 
disconnects from the Hydrogen Sensor in the OGS. 
Then the crew connects the HOPA Outlet and Inlet tools 
to the respective outlet and inlet quick disconnects on 
Hydrogen Sensor ORU. Reference Figure 11. The 
HOPA Evacuation Took is connected to the Portable 
Oxygen Apparatus (PBA) Extension Hose which 
provides a source of dry oxygen. The crew “evacuates” 
potential contaminants from the PBA lines for five 
minutes. Then they disconnect the evacuation tool, 
reconnect the PBA line to the inlet tool, and purge the 
Hydrogen sensor to remove any humidity. The HOPA 
was successfully used by space station crew in October 
2007 and March 2008 after the OGS activations. 



Figure 11: Hydrogen Sensor installed in OGS 

HOPA IMPACT ON CALIBRATED LIFE - Currently, the 
OGS is operated approximately every 90 days for about 
a one-week period. Continuous operation is not possible 
because the Water Recovery System (WRS) is not on- 
orbit to supply a continuous source of potable water. The 
OGS is only operated when potable water is brought to 
the space station via the Shuttle. It is desirable to power 
down the OGS when it is not producing oxygen so that 
valuable power is not consumed, cooling systems are 
not taxed, and component life is not wasted on items 
such as on the 150 day calibration life of the Hydrogen 
Sensor ORU. The calibration life of the Hydrogen 
Sensor ORU is determined by total power on-time, so as 
long as the Hydrogen Sensor ORU is powered, its 
calibration life is being used whether or not the OGS is 
producing oxygen. Once the WRS is operational on orbit 
the OGS may continuously operate unless maintenance 
is required. If shutdown is longer than a predetermined 
time, the HOPA will need to be used to purge humidity 
from the Hydrogen Sensor. 

As mentioned before, the OGS produces oxygen with 
high relative humidity and without the heaters warming 
the Hydrogen sensors, condensation would form on the 
sensor die. Tests have shown the potential for damage 
to energized Hydrogen Sensors. If water is on the 
sensor’s die, electrolysis may result in physical damage 
or may cause the devices to indicate an incorrect level of 
Hydrogen. Without the HOPA, the Hydrogen Sensor 
could not be un-powered therefore using up sensor 
calibration life when operation of the OGS is not 
required. 

HYDROGEN SENSOR ORU LIFE EXTENSION 

The previous Hydrogen Sensor calibration life prior to life 
extension testing would have required that the OGS be 
shut down every 90 days for removal and replacement of 
the sensor (Reference 4). This 90 day life was 
established early in the development of the sensor 
based on historical testing results. Life extension testing 
was initiated due to the strong desire to extend the life 






and to conserve crew time and logistics. The life 
extension potential looked positive because a 
qualification Hydrogen Sensor ORU had run for an 
extended period of time beyond the 90 day life and all 
three sensor dies stayed within calibration limits. 

Two flight Hydrogen Sensors were tested for 200 days 
beyond their acceptance testing (Reference 8). The goal 
of the life extension test was to increase life from 90 to 
180 days. The 200 day test duration was selected 
because it would allow a 10% margin over the 180 day 
goal. 

The two Hydrogen Sensor ORUs were simultaneously 
tested for the 200 day duration. Each ORU has three 
Hydrogen Sensors, for a total of six sensors to be tested. 
Test conditions were the following; Inlet oxygen 
temperature of 70°F with a nominal dew point of 60°F, 
interface temperature of 70° F with background Hydrogen 
of 100 Pa. These conditions were selected to mimic 
nominal OGS conditions for the sensor. 

During the 200 days of testing the six sensors were 
checked for accuracy at 30 day increments. This was 
completed by passing a known amount of Hydrogen 
from -300 Pa to -1575 Pa with two additional data 
points in between. The accuracy of the sensors was 
taken at two separate conditions. First, at 60°F dew point 
with oxygen temperature of 70°F and interface 
temperature of 90°F. Secondly, at 85°F dew point with 
oxygen temperature of 100°F and interface temperature 
of 100°F. The first condition was considered to be OGS 
sensor conditions of a new cell stack and the second to 
be OGS sensor conditions with a cell stack at end of life. 
Sensor pass/fail criteria required the sensor reading to 
be within +/- 180 Pa of the calibration limit. 

The results were as follows in Table 1 : 


At the 30 and 60 day intervals all sensors were within +/- 

70 Pa. 

At the 120 day interval all data all sensors were within 

+/- 115 Pa. 

At the 180 day interval all data all sensors were within 

+/- 150 Pa. 

Table 1: Hydrogen Sensor ORU Specific Results 

At the 200 day interval five of the six sensors were within 
+/- 180 Pa calibration limit. One sensor exceeded the - 
180 Pa by 6 Pa. Actual Hydrogen partial pressure was 
1194 Pa, the sensor indicated a partial pressure of 1008 
Pa. The test was repeated after two more days to verify 
readings results were similar with an outage of 5 Pa. 
See results of this Hydrogen Sensor ORU (3 sensors) in 
Figure 12: ' 
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Figure 12: SN 1002 Calibration Check 

Even though all six sensors were within tolerance after 
the 180 calibration check and one just outside tolerance 
limits at 200 days, it was decided to be conservative and 
extend the 90 day life of the Hydrogen sensor to 1 50 
days. 

Typical data for one sensor from the life extension test is 
shown in Figure 13: 
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Figure 13: SN 1003 Channel B (single sensor) 


SUMMARY 

The ISS Oxygen Generation System was launched in 
July 2006 and has successfully undergone three periods 
of operation in the period July 2007 and March 2008. 
Further evaluation of OGS performance, with periodic 
operation, will continue in anticipation of WRS activation 
in November 2008. With WRS support, longer runtime 
will be achievable. 
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